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AO 91 (Rev! 11/11) 


Criminal Complaint 


United States District 

for the 

Northern District of California 



United States of America 
v. 


AHMAD ABOUAMMO; 

AHMED ALMUTAIRI, a/k/a AHMED ALJBREEN; 
and ALI ALZABARAH, 


Defendant(s) 



CRIMINAL COMPLAINT 


I, the complainant in this case, state that the following is true to the best of my knowledge and belief. 

On or about the date(s) of _ 11/20/2014 to 10/20/2018 _ in the county of _ San Francisco _ in the 

Northern District of _ California _, the defendant(s) violated: 


Code Section 


Offense Description 


18 U.S.C. §951; 
and 

18 U.S.C. § 1519 


Acting as Agent of Foreign Government Without Notice to Attorney General; 
and 

Destruction, Alteration, or Falsification of Records in Federal Investigations 


This criminal complaint is based on these facts: 
See attached affidavit ' 


sf Continued on the attached sheet. 


Sworn to before me and 

Date: \ \ \ C 

City and state: _ 


signed in my presence. 

)\°i 

San Francisco, California 



Letitia Wu, Special Agent, FBI 
Printed name and title 



Judge's signature 

Hon. Thomas S. Hixson, U.S. Magistrate Judge 
Printed name and title 
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I, Letitia L. Wu, a Special Agent with the Federal Bureau of Investigation (“FBI”) in Palo Alto, 
California, being first duly sworn, hereby depose and state the following: 

I. PURPOSE OF AFFIDAVIT AND CRIMINAL CHARGES 

1. I submit this affidavit in support of a Criminal Complaint that charges defendants Ali 
ALZABARAH, Ahmed ALMUTAIRI, also known as Ahmed Aljbreen, and Ahmad ABOUAMMO 
with violations of 18 U.S.C. § 951 and ABOUAMMO with a violation of 18 U.S.C. § 1519. 

2. Specifically, from at least in or about November 20, 2014, up to and including in or about 
May 24, 2015, in the Northern District of California and elsewhere, ALMUTAIRI, the defendant, did 
knowingly act in the United States as an agent of a foreign government, specifically, ALMUTAIRI 
acted within the United States under the direction and control of the Kingdom of Saudi Arabia and 
foreign officials working on behalf of the Kingdom of Saudi Arabia, without prior notification to the 
Attorney General, as required by law, in violation of 18 U.S.C. § 951. 

3. Beginning no later than December 12, 2014, until at least March 12, 2015, in the 
Northern District of California and elsewhere, ABOUAMMO, the defendant, did knowingly act in the 
United States as an agent of a foreign government, specifically, ABOUAMMO acted within the United 
States under the direction and control of the Kingdom of Saudi Arabia and foreign officials working on 
behalf of the Kingdom of Saudi Arabia, without prior notification to the Attorney General, as required 
by law, in violation of 18 U.S.C. § 951. 

4. Further, beginning at least in or about May 21, 2015, up to and including in or about 
December 2015, in the Northern District of California and elsewhere, ALZABARAH, the defendant, did 
knowingly act in the United States as an agent of a foreign government, specifically, ALZABARAH 
acted within the United States under the direction and control of the Kingdom of Saudi Arabia and 
foreign officials working on behalf of the Kingdom of Saudi Arabia, without prior notification to the 
Attorney General, as required by law, in violation of 18 U.S.C. § 951. 

5. On October 20, 2018, in the Northern District of California and elsewhere, 

ABOUAMMO, the defendant, unlawfully, intentionally, and knowingly did alter, destroy, mutilate, 

conceal, and falsify a record or document, namely creating and providing by email to the Federal Bureau 

of Investigation a fabricated, false, and backdated invoice for $100,000 for consulting services to 
AFFIDAVIT OF FBI SA LETITIA WU 
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Foreign Official-1, from CYRCL, LLC, defendant’s sole proprietorship, with the intent to impede, 
obstruct and influence an actual or contemplated investigation of a matter within the jurisdiction of a 
department or agency of the United States, namely the Federal Bureau of Investigation, in violation of 
Title 18, United States Code, Section 1519. 

II. AGENT QUALIFICATIONS 

6. I am a Special Agent with the FBI, and have been since July 2015. I am currently 
assigned to the Counterintelligence Division within the San Francisco Field Office of the FBI. In my 
capacity as a Special Agent, my duties and the training that I have received include the investigation of 
violations of federal criminal law, including counterintelligence related offenses and cybercrimes (such 
as acting as an agent of a foreign government without notification to the Attorney General, economic 
espionage, theft of trade secrets, and computer fraud and abuse violations). 

7. The facts in this Affidavit come from my personal observations, my training and 
experience, and information obtained from other agents, law enforcement personnel, and witnesses. 

8. Unless otherwise noted, wherever in this Affidavit I recount a statement, including 
written statements made by another person, that statement is recounted in substance and in relevant part. 
Statements in quotation marks, if any, are based on preliminary translations or transcriptions, and review 
of or interpretations of communications, all of which may be subject to revision. 

9. Unless otherwise stated, all times listed in this Affidavit are Pacific Time and are 
approximate times. 

10. This affidavit is intended to show merely that there is sufficient probable cause for the 
requested warrant and does not set forth all of my knowledge about this matter. 

III. BACKGROUND 

11. Twitter, Inc. (“Twitter”) is a company headquartered in San Francisco, California, and 
owns and operates a free-access social-networking website of the same name that can be accessed at 
http://www.twitter.com. Users of Twitter, including private individuals, journalists, and public figures, 
create user accounts that can be used to communicate and share information instantly through “Tweets” 
(i.e., 140-character messages prior to 2017) to the public at large, “tweets” to a subset of Twitter users 
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(e.g., to the public or to certain users that “follow” a user), “retweets” by one user of another user, or 
direct messages that are typically visible only to the sender and recipient. 

12. Twitter operates its service in many languages, including English and Arabic. Many 
Twitter users live in Saudi Arabia and some users of Saudi nationality or descent live outside of Saudi 
Arabia, including in the United States. Twitter has access to and maintains data about each of its users, 
and Twitter’s privacy policy outlines the circumstances in which the data maintained by Twitter about 
its users may be disclosed, sold, or transferred. Twitter considers its user data to be valuable, and uses it 
for tailoring revenue-generating advertisements to its users, as well as supplying engaging content and 
other purposes. 

13. Title 18, United States Code, Section 2702, provides that service providers of electronic 
communications and remote computing services, such as Twitter, may voluntarily disclose user data to a 
governmental entity, if the service provider, in good faith, believes than an emergency involving danger 
of death or serious physical injury to any person requires disclosure without delay of data relating to the 
emergency. 

14. The Kingdom of Saudi Arabia (“KSA”) is a monarchy governed by the Saudi King and 
his Royal Court, which is akin to a cabinet or executive office. Members of the King’s Royal Family 
hold most of the country’s important posts. 

15. From at least in or about June 2, 2014, up to and including in or about December 3, 2015, 
a foreign official of the Kingdom of Saudi Arabia who is not identified by name (“Foreign Official-1”) 
was the secretary general of a charitable organization (“Organization No. 1”) of a member of the Saudi 
Arabian Royal Court (“Royal Family Member-1”). Beginning May 3, 2015, Foreign Official-1 listed 
his employer on his U.S. visa application as the “Royal Court.” 

16. Ali Hamad ALZABARAH is a citizen of Saudi Arabia and resided in San Bruno, 
California from at least 2014 until December 3, 2015. Funded by a Saudi Arabian scholarship, 
ALZABARAH entered the United States in 2005 and studied and obtained degrees in computer science 
from various universities in the United States. From in or about August 2013 to in or around December 
2015, ALZABARAH worked as a site reliability engineer at Twitter in San Francisco, California. 
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17. Ahmad ABOUAMMO is a United States citizen and resided in the Northern District of 
California from at least November 2013 until May 22, 2015, and thereafter resided in Seattle, 
Washington. ABOUAMMO was an employee of Twitter, Inc. from on or about November 3, 2013 to 
May 22, 2015. ABOUAMMO was a Media Partnerships Manager responsible for the Middle East and 
North Africa (“MENA”) region at Twitter. ABOUAMMO was involved in assisting notable accounts of 
public interest, brands, journalists, and celebrities for the MENA region with content, Twitter strategy, 
and sharing best practices. 

18. Ahmed ALMUTAIRI, also known as Ahmed ALJBREEN, is a Saudi citizen. 
ALMUTAIRI was present in the United States of America between approximately August 21, 2014 
until approximately May 24, 2015. From at least May 2014 to the present, ALMUTAIRI has controlled 
a Saudi social media marketing company that does work for Organization No. 1 and members of the 
Saudi Royal Family, including Royal Family Member-1. ALMUTAIRI traveled to the United States on 
a student visa in August 2014 for the purpose of studying English in the San Francisco Bay Area. 

19. ABOUAMMO and ALZABARAH had access to proprietary and confidential Twitter 
information, including information about Twitter users, including the user-provided email addresses, 
birthdates, phone number, and internet protocol (“IP”) addresses. 

20. Twitter employees, including ABOUAMMO and ALZABARAH, agree to abide by the 

Twitter “Playbook” which outlines the policies Twitter employees must obey as part of their 

employment. Twitter’s 2013 employment contracts with ABOUAMMO and ALZABARAH, prohibited 

them from engaging in outside employment or consulting “or any other business activity that would 

create a conflict of interest with the Company.” Twitter’s 2013 Employee Invention Assignment and 

Confidentiality Agreements with ABOUAMMO and ALZABARAH affirmed “a relationship of 

confidence and trust” between Twitter and each employee “with respect to any information of a 

confidential or secret nature that may be disclosed to me by the Company or a third party that relates to 

the business of the Company” and defined “Proprietary Information” to include “customer lists and 

data.” The Employee Invention Assignment and Confidentiality Agreement further required 

ABOUAMMO and ALZABARAH to “keep and hold all such Proprietary Information in strict 

confidence and trust. I will not use or disclose any Proprietary Information without the prior written 
AFFIDAVIT OF FBI SA LETITIA WU 4 
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consent of the Company” and required them during their employment not to “use[] any Company 
information for any other business or employment.” 

21. Twitter’s “Playbook Acknowledgement,” which ABOUAMMO and ALZABARAH each 
signed during 2013, stated that each would read, understand, and abide by Twitter’s policies, including 
the Security Handbook, which defined user data as confidential data and prohibited sharing confidential 
data with third parties without approval. 

22. Twitter’s “Gift Policy” during ABOUAMMO and ALZABARAH’s employment stated: 
“[f]or gifts exceeding $100 in value, bring the gift to the attention of both your manager and VP of HR 
before returning to sender.” 

23. Neither ABOUAMMO nor ALZABARAH’s job duties included a need to access a 
Twitter user’s private information, and doing so was a reportable violation of the Twitter Playbook 
policies regarding protecting user data. Since December 2015, Twitter has enhanced its controls and 
permissions to restrict access to user information only to those whose duties require access. 

24. As of November 1,2019, ALZABARAH, ALMUTAIRI, and ABOUAMMO have not 
provided notification to the Attorney General that they were acting as an agent of a foreign government. 

IV. SAUDI ARABIA’S USE OF ABOUAMMO AND ALZABARAH TO OBTAIN PRIVATE 

TWITTER USER DATA ON BEHALF OF THE KINGDOM OF SAUDI ARABIA 

A. ABOUAMMO’s Contact With AHMED ALMUTAIRI and Foreign Official-1 Starting in 

June 2014 and Meeting With Foreign Official-1 in the United States and the United 

Kingdom 

25. Foreign Official-1, on behalf of KSA, began cultivating employees of Twitter in an effort 
to obtain private user information that it could not obtain elsewhere. 

26. In April 2014, according to emails from Twitter, a public relations firm representing the 
Embassy of the Kingdom of Saudi Arabia contacted Twitter and asked for assistance in verifying the 
Twitter account of a Saudi Arabian news personality. Twitter assigned the task to ABOUAMMO. In an 
email, ABOUAMMO explained to the public relations firm that he was heading the media partnerships 
for the MENA region, and part of his job was to work with media partners to share best practices and 
work on Twitter strategy. ABOUAMMO also asked the public relations firm to let him know if they 
have any other requests regarding the Saudi government. 
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27. On or about May 16, 2014, a representative from the U.S.-Saudi Arabian Business 
Council in Vienna, VA, emailed ABOUAMMO and asked him to arrange a tour of Twitter’s San 
Francisco office for a group of Saudi “entrepreneurs.” ABOUAMMO agreed and coordinated with 
others at Twitter to schedule the tour for June 13, 2014. A follow-up email informed ABOUAMMO 
that the attendees would include Foreign Official-1, who subsequently (in early 2015) became the head 
of Royal Family Member-1 ’s private office. On the day of the tour, June 13, 2014, ABOUAMMO 
emailed his telephone number to Foreign Official-1. The email subject stated “contact for ahmad” and 
the body of the message contained only ABOUAMMO’s ten-digit personal phone number and his 
signature block. 

28. Also on the day of the tour, Foreign Official-1 emailed ABOUAMMO about verifying 
the Twitter account of Royal Family Member-1, indicating that Foreign Official-1 was working for and 
at the direction of Royal Family Member-1 with respect to his online presence on the Twitter platform. 

29. On June 14, 2014, Foreign Official-1 emailed ABOUAMMO and asked for 
ABOUAMMO’s contact information. ABOUAMMO responded by email with his Twitter email 
address and his personal Skype account, and again provided his personal telephone number. On that 
date, at approximately 3:36 p.m. Pacific, toll records show Foreign Official-1 contacting ABOUAMMO 
in a telephone call that lasted approximately 1 minute, 47 seconds. Subsequently, on June 15 and 17, 
2014, Foreign Official-1 emailed ABOUAMMO two photographs - one of Foreign Official-1 with 
ABOUAMMO, and another of Foreign Official-1, ABOUAMMO, and the group of visitors to Twitter 
on June 13, 2014. 

30. In or around late November 2014, Foreign Official-1 and ABOUAMMO communicated 
by telephone and email to coordinate an in-person meeting in London, United Kingdom, in early 
December 2014. For example, on November 20, 2014, ABOUAMMO emailed Foreign Official-1 
through ABOUAMMO’s Twitter account and asked if Foreign Official-1 had finalized his trip to 
London and informed Foreign Official-1 that he would be in London between December 1, 2014 and 
December 5, 2014. ABOUAMMO traveled to London, United Kingdom on November 29, 2014 to 
attend a Twitter global media summit. 
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31. Around this same time, ABOUAMMO also met with Ahmed ALMUTAIRI, whose 
company does work for Foreign Official-1 ’s charitable organization. On November 15, 2014, 
ALMUTAIRI sent an email to ABOUAMMO requesting an “urgent meeting” in San Francisco to 
discuss their “mutual interest.” ALMUTAIRI explained he was the advisor for a “VVIP 1 st Degree 
Member of the Saudi Royal Family.” On November 20, 2014, ALMUTAIRI met with ABOUAMMO 
in front of the Twitter office in San Francisco, California, and posted a photograph of himself with 
ABOUAMMO on ALMUTAIRI’s Twitter account. On December 1, 2014, prior to ABOUAMMO’s 
meeting with Foreign Official-1 in London, ALMUTAIRI emailed ABOUAMMO at his Twitter account 
and stated, “I’m quite confident that by both of us cooperating and working together, we’ll achieve the 
goals of Twitter in the region.” 

32. Foreign Official-1 emailed ABOUAMMO on December 4, 2014, and stated “I’m in Paris 
I will come to london tomorrow for one day to meet you on Friday. When I arrive I will call you.” The 
next day, December 5, 2014, Foreign Official-1 contacted ABOUAMMO by telephone in a call that 
lasted approximately four seconds, and Foreign Official-1 and ABOUAMMO met in person in London, 
United Kingdom. On December 6, 2014, ABOUAMMO returned to San Francisco. 

33. As discussed below, I met with ABOUAMMO on October 20, 2018, and ABOUAMMO 
told me at that time that, while in London, Foreign Official-1 gave him a watch. Records obtained by 
the FBI show that, on or about December 27, 2014, ABOUAMMO contacted an online consignment 
store for luxury watches about a Hublot Unico Big Bang King Gold Ceramic watch. The consignment 
store offered to sell the watch for $20,000. In January 2015, ABOUAMMO responded to 
advertisements of potential buyers looking for luxury watches on Craigslist.org, claiming his watch, 
which he stated he purchased in London, U.K., was worth $35,000 and that he would accept an offer of 
no less than $25,000. At the request of the FBI, a United Kingdom law enforcement official visited the 
store where ABOUAMMO had claimed in his online communications to have purchased the watch, 
however, the store informed the law enforcement official that it did not carry or sell the Hublot Unico 
Big Bang King Gold Ceramic watch. 

// 


AFFIDAVIT OF FBI SA LETITIA WU 


7 





1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


Case 3:19-mj-71824-MAG Document 1 Filed 11/05/19 Page 9 of 27 

B. ABOUAMMO’s Unauthorized Access of Private Twitter User Data and Continued 

Contact With Foreign Official-1 

34. Within one week of ABOU AMMO’s meeting in London with Foreign Official-1, 
ABOUAMMO began accessing private Twitter user information of interest to Foreign Official-1 and the 
Saudi Royal Family. 

35. On December 12, 2014, ABOUAMMO accessed Twitter User-1 ’s email address through 
Twitter’s computer systems. Based on the FBI’s review of Twitter User-1 ’s public postings, Twitter 
User-1 was a prominent critic of the Kingdom of Saudi Arabia and the Royal Family with over 
1,000,000 Twitter followers. ABOUAMMO accessed Twitter User-1’s email address again on January 
5, 2015, January 27, 2015, February 4, 2015, February 7, 2015, February 18, 2015, and February 24, 
2015. 

36. On or about January 17, 2015, Foreign Official-1 began communicating with 
ABOUAMMO on ABOUAMMO’s personal email in addition to his Twitter email account. On January 
17, 2015, Foreign Official-1 emailed ABOUAMMO at ABOUAMMO’s personal email and stated only 
“as we discussed in london...” Foreign Official-1 attached to the email a document that discussed how 
Twitter User-1 had violated both Twitter policy and Saudi laws. On January 20, 2015, Foreign Official- 
1 called ABOUAMMO twice (the calls lasting 19 seconds and 51 seconds, respectively). On January 
22, 2015, Foreign Official-1 called ABOUAMMO seven times (no answer, 6 seconds, 5 seconds, 3 
seconds, 4 minutes 37 seconds, 3 mi n utes 36 seconds, and 39 seconds, respectively). ABOUAMMO 
also accessed the email address provided by user @KingSalman the same day. The handle 
@KingSalman was the Twitter Account for Saudi King Salman bin Abdulaziz A1 Saud. Foreign 
Official-1 called ABOUAMMO on January 23, 24, and twice on January 25, 2015 (1 minute 57 seconds, 
no answer, 1 minute 57 seconds, and 6 seconds, respectively). On January 27, 2015, ABOUAMMO 
accessed Twitter User-1 ’s user email address again. The next day, Foreign Official-1 called 
ABOUAMMO three times (11 seconds, 5 seconds, and no answer). 

37. On February 3, 2015, Foreign Official-1 forwarded ABOUAMMO an email from Twitter 
Support revealing that Foreign Official-1 filed a complaint with Twitter against Twitter User-2, who was 
impersonating a member of the Saudi Royal Family. The email indicated Foreign Official-1 filed a 
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report with Twitter advising he was the representative of the individual being impersonated by Twitter 
User-2. Based on the FBI’s review of the Twitter User-2’s public postings, Twitter User-2 appeared to 
be a critic of the Kingdom of Saudi Arabia and the Royal Family. Twitter Support requested Foreign 
Official-1 provide proof that he is authorized to represent the individual. On that same day, 
ABOUAMMO’s close relative residing in Beirut, Lebanon, opened a Lebanese bank account at the 
Beshara El-Khoury branch of Bank Audi in Beirut (“Bank Audi Account”) and the account later 
received payments that were later disbursed to ABOU AMMO's account in the United States, discussed 
below. On February 4,2015, ABOU AMMO accessed Twitter User-1 ’ s user information again and was 
able to view account information, including the email address and telephone number associated with 
Twitter User-1 ’s account. According to a Twitter Security Engineer that FBI interviewed, the amount of 
information a Twitter employee can view through Twitter computer systems depended on both the user- 
provided information and the level of access of the Twitter employee. 

38. On February 5, 2015, Foreign Official-1 emailed ABOU AMMO at his Twitter account 
and attached a document written in Arabic and translated with the banner, “Urgent Report - Secret and 
private” that discussed tweets by Twitter User-2. On February 7, 2015, ABOU AMMO accessed Twitter 
User-l’s email address and phone number as well as Twitter User-2’s email address. 

39. On February 9, 2015, ABOU AMMO registered the website for CYRCL, LLC at 
http://cyrcl.co. As discussed below, ABOUAMMO used this limited liability company to receive 
$100,000 USD from Foreign Official-1 in 2016. On February 12 and 13, 2015, Foreign Official-1 called 
ABOUAMMO five times (7 minutes 28 seconds, 1 minute 24 seconds, 2 minutes 10 seconds on 
February 12, 2015, and 15 and 17 seconds on February 13, 2015). On February 13, 2015, Foreign 
Official-1 sent a $100,000 wire transfer to ABOUAMMO’s close relative in Beirut, Lebanon. 

40. On February 16, 2015, Foreign Official-1 called ABOUAMMO three times. Two days 
later, ABOUAMMO accessed Twitter User-l’s email address and phone number. On February 19, 

2015, ABOUAMMO created an online user ID and password to access the Bank Audi Account his close 
relative opened in Lebanon on February 3, 2015. On February 24, 2015, ABOUAMMO accessed 
Twitter User-1 ’s email address and phone number. On the same day, a $9,963 wire transfer was sent 
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! f 

from the Lebanon Bank Audi Account to ABOUAMMO’s Bank of America account ending in 3078 
(“Bank of America Account”). 

41. On March 5, 2015, Foreign Official-1 called ABOUAMMO 11 times. Foreign Official-1 
also called ABOUAMMO three times on March 6, 2015. On March 8, 2015, ABOUAMMO sent 
Foreign Official-1 a Twitter direct message stating “proactive and reachvely we will delete evil my 
brother.” On March 12, 2015, a $9,911 wire transfer was sent from the Lebanon Bank Audi Account to 
ABOUAMMO’s Bank of America Account. 

42. On May 22, 2015, ABOUAMMO resigned from his position at Twitter. In sum, 
ABOUAMMO accessed Twitter User-1’s email address and phone number between January 5, 2015, 
and February 24, 2015 and accessed Twitter User-2’s email address on February 7, 2015. Based on 
information provided by Twitter and ABOUAMMO’s former supervisor at Twitter, ABOUAMMO had 
no legitimate business use as a Media Partnerships Manager for accessing users’ account information, 
and doing so would have been a violation of the company’s policies. 

C. ABOUAMMO Quits Twitter and Moves to Seattle but Continues Contact With and 

Accepts Money from Foreign Official-1 Through a Relative’s Foreign Account 

43. Even after ABOUAMMO left Twitter, Foreign Official-1 paid him for services rendered 
and for continuing to contact Twitter employees on behalf of KSA officials. 

44. In late May 2015, ABOUAMMO moved from the San Francisco Bay Area to Seattle, 
Washington for a new job. After ABOUAMMO started his new job, Foreign Official-1 continued to 
contact him with requests for Twitter to take action on certain user accounts, including requests to shut 
down certain accounts for violating Twitter’s terms of service and to verify certain official users at 
Twitter. ABOUAMMO attempted to facilitate Foreign Official-l’s requests by contacting his former 
colleagues at Twitter. 

45. While facilitating requests from Foreign Official-1, ABOUAMMO continued to transfer 
money from the Bank Audi Account to the Bank of America Account. On June 15, 2015, a $10,000 
wire transfer was sent from the Bank Audi Account to the Bank of America Account which was then 
used as part of ABOUAMMO’s down payment for his new residence. A July 7, 2015, a $30,000 wire 
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transfer was sent from the Bank Audi Account to the Bank of America Account with a notation that it 
was part of a “down payment of an appartment [sic] in USA.” 

46. Two days later, on July 9, 2015, Foreign Official-1 sent ABOUAMMO a wire transfer 
receipt through Twitter direct message showing he had wired $100,000 from the National Commercial 
Bank in Saudi Arabia to the Bank Audi Account. Along with the wire transfer receipt, Foreign Official- 
1 apologized for the late response. ABOUAMMO then responded asking whether Foreign Official-1 
needed anything from Twitter. On July 13, 2015, ABOUAMMO emailed Twitter Support and requested 
verification (a form of authentication by Twitter that an account actually belongs to a notable individual, 
organization, or company) of the Twitter account @majedhogail, which is used by the Minister of 
Housing of the Kingdom of Saudi Arabia. On July 30, 2015, ABOUAMMO submitted a cashier’s 
check for $56,495.30 toward down payment for a residence in Seattle. 

47. On August 23, 2015, Foreign Official-1 called ABOUAMMO (3 minutes and 11 
seconds). Then on September 8, 2015, Foreign Official-1 emailed ABOUAMMO at ABOUAMMO’S 
personal email and attached two documents - one discussing the Saudi penalties for hacking, 
unauthorized access of information, violation of privacy and defamation of other; the other document 
discussing the Saudi penal law on dissemination and disclosure of classified information and documents. 
On September 17, 2015, ABOUAMMO received an email from Twitter Support confirming he had 
requested verification of the Twitter account @infographic_ksa, which based on the FBI’s review of 
public postings, appears to feature Saudi government information. Ten days later, Foreign Official-1 
called ABOUAMMO (4 seconds). 

48. On December 11, 2015, Foreign Official-1 emailed ABOUAMMO and stated, “Hello, 
Call me. Please as soon as possible. Thank you.” Foreign Official-1 also called ABOUAMMO but 
records show the call never connected. On the same day, ABOUAMMO emailed a Director in Twitter’s 
Dubai office asking for help with the verification of the Twitter account @aleissaahmed, the Saudi 
Minister of Education. ABOUAMMO explained that he was asking on behalf of “King Salman’s team” 
and it would be great if she could escalate it. 

49. On December 31, 2015, ABOUAMMO created a limited liability company, CYRCL, 

LLC and registered it with the State of Washington. On the same day, ABOUAMMO received an 
AFFIDAVIT OF FBI SALETITIAWU H 





1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


Case 3:19-mj-71824-MAG Document 1 Filed 11/05/19 Page 13 of 27 

employer identification number from IRS for CYRCL, LLC. On January 12, 2016, ABOUAMMO 
opened a business checking account at Chase Bank. On January 25, 2016, Foreign Official-1 wired 
$100,000 from the National Commercial Bank in Saudi Arabia to ABOUAMMO’s newly opened Chase 
Bank account. 

50. On February 5, 2016, ABOUAMMO forwarded a verification request to Twitter Support 
for the Twitter account @saudiarabia and stated that it will be used by “the King’s team."’ 

ABOUAMMO then received two calls from Foreign Official-1 on February 16, 2016 (42 seconds and 8 
seconds). Then on March 1, 2016, ABOUAMMO received an email from Twitter Support confirming 
he had requested verification of the another Twitter account, which was used by the Saudi Ambassador 
to Iraq. ABOUAMMO followed-up with an email to someone in Twitter Support stating that the 
request was on behalf of his “old partners in the Saudi Government.” Five days later. Foreign Official-1 
called ABOUAMMO (2 minutes and 29 seconds). 

D. FBI Interview of ABOU AMMO. and ABOUAMMO’s False Statements and Documents 

Emailed to FBI 

51. On October 20, 2018,1 traveled to Seattle, Washington to interview ABOUAMMO at his 
residence about his receipt of the watch and his communications with Foreign Official-1 and others. I 
identified myself as an agent of the FBI in Palo Alto, California and that I was conducting an 
investigation there. 

52. During the course of that interview, as set forth in detail herein, ABOUAMMO 
communicated, in substance and in part, the following information: 

a. ABOUAMMO stated that he looked at the details of the User-1 account after 
receiving an email from Foreign Official-1 about that account; 

b. ABOUAMMO stated that he met with Foreign Official-1 in London and 
received a watch from Foreign Official-1, but described it as “plasticky” and 
“junky” and valued it at $500; 

c. ABOUAMMO stated that he only received a $ 100,000 USD wire from Foreign 
Official-1, which ABOUAMMO stated was payment for consulting and media 
strategy work; and 

d. ABOUAMMO showed me communications with Foreign Official-1 conducted 
over Twitter direct messages; one of the messages contained an embedded 
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photograph of a wire transfer receipt for $100,000 USD from Foreign Official-1 
to ABOUAMMO’s relative in Lebanon on July 9, 2015. Immediately after 
showing FBI the wire transfer receipt, I observed ABOUAMMO delete the direct 
message from his phone. 

53. Based on the information above, I believe that ABOUAMMO made false statements to 
the FBI about the type and value of the watch he received from Foreign Official-1. ABOUAMMO 
stated that the watch was worth $500 and was a “Halo” watch, when in reality the watch was a Hublot 
watch that ABOUAMMO had tried to sell for at least $20,000. ABOUAMMO further stated that he had 
received $100,000 from Foreign Official-1, when in reality he had received at least $300,000 from him. 

54. On October 20, 2018, during and following the interview, ABOUAMMO produced 
several documents to the FBI, one of which was created or altered by ABOUAMMO during the 
interview in order to corroborate his statements after the interview had begun. ABOUAMMO claimed 
that he created a consulting company, identified as CYRCL, LLC, and that he consulted for Foreign 
Official-1 in 2015 after he left Twitter. ABOUAMMO stated that he received a payment of $100,000 
for one year of consultancy. During the interview, ABOUAMMO offered to obtain a copy of the 
consulting contract from a desktop computer that he claimed was in his bedroom, and requested that the 
Agents not follow him to the bedroom. A few minutes later, ABOUAMMO emailed an undated invoice 
to the email address of a Palo Alto, California based FBI Special Agent. 

55. I believe that ABOUAMMO created the invoice in his residence on a computer while 
Agents were waiting for ABOUAMMO to provide them with the invoice that was discussed. The 
address on the invoice for services ABOUAMMO said were rendered in 2015 and 2016 was 
ABOUAMMO’s current address, however, public records show that the property was built in 2017 and 
ABOUAMMO did not purchase it until August 2017, and the metadata properties associated with the 
file emailed to the FBI indicates that the file was created on the date of the interview (i.e., October 20, 
2018). Another invoice ABOUAMMO voluntarily provided the FBI to corroborate the existence of his 
business showed a file creation date several months prior to the interview. 

// 
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E. ALZABARAH’s Contact With ALMUTAIRI Starting From February 2015 Through 

May 2015 

56. ALMUTAIRI acted as an intermediary between ALZABARAH and Foreign Official-1. 

57. On or around February 16, 2015, while he was employed by Twitter, ALZABARAH 
received a telephone call from ALMUTAIRI. ALZABARAH and ALMUTAIRI spoke for 
approximately 15 minutes. Approximately three days later, on or about February 19, 2015, 
ALZABARAH sent his curriculum vitae to ALMUTAIRI via email. ALMUTAIRI acknowledged 
receipt the next day, on or about February 20, 2015. Also on or about February 20, 2015, ALMUTAIRI 
posted a photograph of himself and ALZABARAH on ALMUTAIRI’s Twitter account. Accompanying 
the posted photograph, ALMUTAIRI commented about being honored to have had dinner with his 
friend ALZABARAH the previous day. ALMUTAIRI also commented that ALZABARAH was the 
only Saudi Arabian who worked at Twitter. As further examples of ALZABARAH’s contact with 
ALMUTAIRI, in or about March 2015, ALMUTAIRI asked ALZABARAH about the process of 
Twitter verifying user accounts as authentic. 

58. On or about May 12, 2015, Foreign Official-1 traveled from Saudi Arabia to Washington, 
D.C., as part of an official delegation from the Kingdom of Saudi Arabia. 

59. On or around May 13, 2015, the day after Foreign Official-1 arrived in the United States, 
ALZABARAH made plans to travel to meet Foreign Official-1 in Washington, D.C. Among other 
things, in Apple iMessages found on ALZABARAH’s Twitter-owned laptop, ALZABARAH explained 
the purpose of his trip to his wife: 

Okay, there is an important subject I would like to talk to you about. I am 
traveling to Washington at the request of the office of [Royal Family 
Member-1]. At ten o’clock tonight and I return tomorrow at ten o’clock at 
night. 

ALZABARAH also explained: 

[ALMUTAIRI] called me. He said he was in Washington and told them 
about me and everything about me and they said ‘we would like to meet 
with him wherever he is right now,’ and that is the Director of the private 
office of [Royal Family Member-1]. 
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60. By May 2015, Foreign Official-1 was an employee of the Saudi Arabian Royal Court. 
He was the Director of the private office of Royal Family Member-1 and the Secretary General for two 
charitable organizations for Royal Family Member-1. That same day, ALZABARAH purchased an 
airline ticket to the Washington, D.C., area. Based on airline records and other evidence obtained 
through legal process, ALZABARAH planned to stay, and did in fact stay, in the Washington, D.C., 
area for less than 12 hours on May 14, 2015. 

61. Evidence obtained by the FBI indicates that ALZABARAH communicated with 
representatives of the KSA during his visit to Washington, DC. Specifically, evidence obtained by the 
FBI shows the following (all times Eastern): 

a. Shortly after landing at Dulles Airport in the Washington, D.C.-area, 
ALZABARAH made contact with ALMUTAIRI. Specifically, ALZABARAH 
called ALMUTAIRI at approximately 8:53 a.m. (11 seconds), and ALMUTAIRI 
called ALZABARAH at approximately 9:06 a.m. (58 seconds). 

b. From the airport, ALZABARAH took a cab to a residence in Fairfax, Virginia, 
arriving at approximately 9:31 a.m. Open source databases and Department of 
State visa records indicate the residence was leased by an employee of the Saudi 
Ministry of Interior at the Embassy of the Kingdom of Saudi Arabia in 
Washington, D.C. (the “Fairfax Address”) 

c. Upon arriving at the Fairfax Address, ALMUTAIRI called ALZABARAH at 
approximately 9:32 a.m. (28 seconds) and at approximately 9:34 a.m. (no 
answer). 

d. Several hours later, ALMUTAIRI called ALZABARAH at approximately 1:38 
p.m. (26 seconds) and again at approximately 2:22 p.m. (10 seconds). 

e. At approximately 4:40 p.m., ALMUTAIRI scheduled a trip with a ride hailing 
service that terminated at the intersection adjacent to the Fairfax Residence, 
arriving at approximately 4:42 p.m. 

f. At approximately 4:42 p.m., ALZABARAH scheduled a trip with the same ride 
hailing service and with the same named driver used by ALMUTAIRI. 
ALZABARAH travelled from the Fairfax Address to Dulles Airport. 

g. At approximately 7:59 p.m., ALZABARAH boarded a flight at Dulles Airport 
and returned to San Francisco that evening. 


AFFIDAVIT OF FBI SA LETITIA WU 


15 







1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


Case 3:19-mj-71824-MAG Document 1 Filed 11/05/19 Page 17 of 27 

I . | 


62. During ALZABARAH’s trip to Washington, D.C., ALMUTAIRI, who had travelled 
from San Francisco to Washington, D.C. on May 12, was staying at rental lodging adjacent to a hotel in 
Washington, D.C., which Foreign Official-1 specified as his intended lodging. Additionally, on or about 
May 13, 2015, the day before ALZABARAH travelled to Washington, D.C., ALMUTAIRI posted a 
photograph of himself with Royal Family Member-1, for whom Foreign Official-1 worked. In the 
caption for the posting, ALMUTAIRI wrote that it was an honor for him to meet with Royal Family 
Member-1 in Washington. Based on non-content phone records, from on or about May 6, 2015, through 
on or about May 24, 2015, ALMUTAIRI exchanged at least 10 telephone contacts with Foreign 
Official-1. 

F. ALZABARAH’s Unauthorized Access of Private Twitter User Data and Continued 

Contact with ALMUTAIRI and Foreign Official-1 

63. Within one week of returning to San Francisco, ALZABARAH began to access without 
authorization private data of Twitter users en masse. Specifically, although ALZABARAH had not 
accessed the private user data of any Twitter Accounts since February 24, 2015, starting on May 21, 
2015, through November 18, 2015, ALZABARAH accessed without authorization through Twitter’s 
computer systems the Twitter user data of over 6,000 Twitter users, including at least 33 usernames for 
which Saudi Arabian law enforcement had submitted emergency disclosure requests to Twitter. A 
Twitter Security Engineer informed the FBI that, although ALZABARAH may have had grandfathered 
access to view user information through an internal Twitter tool called “Profile Viewer,” ALZABARAH 
had no legitimate business purpose as a Site Reliability Engineer to access user accounts. 
ALZABARAH’s job was to help keep the site up and running, which did not involve accessing 
individual user accounts. 

64. On May 21,2015, ALZABARAH first accessed through Twitter’s computer systems the 

Twitter user data of Twitter User-1 at approximately 3:17 p.m. On May 21, 2015, Twitter User-1 shared 

a public Twitter relating to the Royal Family. That same day, Foreign Official-1 asserted publicly 

through Twitter that Twitter User-1 ’s posting was false, and ALMUTAIRI and ALZABARAH 

exchanged 3 telephone contacts, including one call lasting approximately 21 minutes at approximately 

7:30 p.m., which was approximately four hours after ALZABARAH accessed Twitter User-1 ’s data. 
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ALZABARAH accessed Twitter User-l’s account and was able to view his email address, phone 
number, and IP address. Twitter User-l’s account was the only Twitter account that ALZABARAH 
accessed through Twitter’s computer systems on that day. In total, from May 21 through October 2015, 
ALZABARAH accessed through Twitter’s computer systems Twitter User-l’s account on at least nine 
separate days. During that time, the Kingdom of Saudi Arabia made no emergency disclosure requests 
to Twitter regarding Twitter User-l’s account. 

65. After his 12-hour visit to Washington, D.C., on May 14, 2015, ALZABARAH’s phone 
records, which were obtained by the FBI through legal process, also show that he began having direct 
contact with Foreign Official-1. ALZABARAH accessed private Twitter user data on May 21,2015, the 
same day that ALZABARAH had telephone contact with ALMUTAIRI. ALZABARAH next accessed 
private Twitter user data on May 29, 2015, close in time with his telephone exchanges with Foreign 
Official-1. Specifically, the investigation has identified the following activities on May 29, 2015: 


Approximate 

lime 

(Pacific) 

Foreign Official-1 
Communications With 

ALZABARAH 

ALZABARAH’s Access of Private User Data of 
Twitter Accounts 

8:34 a.m. 


Twitter User-3 (email and IP address). This account is 
now closed, but the FBI Google search for that 
account show that it is in Arabic and had posted 
pictures of an improvised explosive device. 

8:38 a.m. 

ALZABARAH called 
Foreign Official-1 (2:37). 


9:17 a.m. 

ALZABARAH called 
Foreign Official-1 (2:48). 


9:18 a.m. 


Twitter User-3 (email and IP address). 

9:26 a.m. 

Foreign Official-1 called 
ALZABARAH (3:38). 


9:27 a.m. 


Twitter User-4 (email and TP address). The account is 
now deactivated (i.e., closed). 


Later the same day, the Kingdom of Saudi Arabia submitted emergency disclosure requests for 
information regarding both Twitter User-3 and Twitter User-4, which Twitter granted. 

66. Through a court-approved search of ALZABARAH’s Apple ID account, the FBI found 
an Apple Note that had been last modified on June 7, 2015 (initially created on May 12, 2015). That 
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note stated in Arabic, “[an honorific term for Foreign Official-1,] I would like to ask your advice and 
opinion regarding an issue. I just saw the announcement the ministry made regarding rewards. Do you 
think it applies to us? What do you advise? Should we ask them?” In this statement, I believe that 
ALZABARAH wanted to inquire about potentially receiving some of the announced reward money in 
exchange for the information that he had accessed for and provided to Foreign Official-1. Several days 
earlier, on June 3, 2015, a U.S. based news outlet reported that Saudi Arabia offered a $1.9 million 
reward (5 million Saudi Riyals) for information that would avert future terrorist attacks. 

67. ALZABARAH had access to information that was more detailed than the information 
Twitter did or would have disclosed to KSA in response to emergency disclosure requests. For example, 
ALZABARAH also had access to all recent IP address information, device used, user-provided 
biographical information, logs that contained the user’s browser information, and a log of all of a 
particular user’s actions on the Twitter platform at any given time. 

68. ALZABARAH continued this conduct into the subsequent months. During June 2015, 
ALZABARAH accessed without authorization through Twitter’s computer systems the Twitter user data 
of approximately 5,726 Twitter users, including Twitter User-1 ’s account. 

69. On June 6, 2015, between approximately 12:20 p.m. and 12:50 p.m. Pacific [7:20 p.m. 
and 7:50 p.m. UTC], ALZABARAH accessed without authorization through Twitter’s computer 
systems the Twitter user data (email and IP address) of four specific accounts: Twitter User-5, Twitter 
User-6, Twitter User-7, and Twitter User-8. 

70. A court-authorized search of Foreign Official-1 ’s email account revealed that on the same 
day, June 6, 2015, at approximately 5:33 p.m. Pacific [12:33 a.m. UTC on June 7], Foreign Official-1 
saved a note in his email account with information about these same four Twitter users. Specifically, the 
note in Arabic stated: 

[Twitter User-5:] 

[a]s far as I can tell his name is [redacted], he’s about 22, and the IP is [redacted]. Last 

logged in on 06/06/2015 at 16:57 UTC. Using an iPhone. 

[Twitter User-6:] 

Is not in Saudi Aabia; he goes back and forth between Turkey and Iraq. 
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[Twitter User-7:] 

He is in Turkey and has a friend, or something, and they use the same Michigan State 
University account. 

[Twitter User-8:] 

This one is a professional. He’s a Saudi that uses encryption by a British named 
Volter/Folter [phonetic spelling]. He signed up for the service but he does his own 
encryption. We tracked him and found that 12 days ago he signed in once without 
encryption from IP [redacted] at 18:40 UTC on 05/25/2015. This one does not use a cell 
phone at all, just a browser. He’s online right using Firefox form a windows machine. 

71. The FBI obtained records from Twitter relating to any emergency disclosure requests 
submitted by Saudi Arabian law enforcement for the four accounts listed above. Twitter records 
showed: 

a. Twitter User-5: Saudi Arabian law enforcement submitted an emergency 
disclosure request on June 4, 2015, and Twitter granted the request on the same 
day. This was two days before ALZABARAH accessed information on Twitter 
User-5 and Foreign Official-1 updated his notes with information on Twitter 
User-5. 

b. Twitter User-6: There are no records of any emergency disclosure requests 
between at least May 1, 2015 through February 16, 2016. 

c. Twitter User-7: There are no records of any emergency disclosure requests 
between at least May 1, 2015 through February 16, 2016. 

d. Twitter User-8: Saudi Arabian law enforcement submitted an emergency 
disclosure request on May 30, 2015 and Twitter granted the request on the same 
day. 


72. Based on a review of the evidence, the information found in Foreign Official-1 ’s email 
account related to the “last access” by Twitter User-5 (i.e., June 6, 2015 at 4:57 p.m. UTC) was not 
provided by Twitter through the emergency disclosure request response sent on June 5, 2015 at 
approximately 12:41 a.m. UTC. The “last access” date and time of Twitter User-5 post-dates Twitter’s 
response to the emergency disclosure request. Likewise, the information found in Foreign Official-1 ’s 
email account related to Twitter User-6 and Twitter User-7 was not provided by Twitter through an 
emergency disclosure request because no such request was granted. 

73. Twitter’s standard data production for emergency disclosure requests includes the 

account file, the creation IP file, device file, and 48 hours of session IPs, which are further described as: 
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• Account File: account ID number, date and time of account creation, last modified 
date, user’s email address, application used to create the account, user name and time 
zone (if specified by user); 

® Creation IP File: contains the IP and timestamp associated with the account creation; 

® Device File: date/time device is registered, date/time device is modified, type of 
device, phone carrier, and verified phone number; 

• IP Audit: account ID number, date/time of login, and IP address for login. 

74. On June 14, 2015, Foreign Official-1 called ALZABARAH at approximately 12:57 p.m. 
Pacific (unanswered), at approximately 1:17 p.m. (unanswered), and at approximately 1:58 p.m. (7 
minutes 16 seconds). That same day, between approximately 11:51 a.m. and 11:25 p.m. Pacific, 
ALZABARAH accessed without authorization the private user data of approximately 5,502 Twitter 
users, including possibly using bulk searches in Twitter’s internal databases. 

75. On June 18, 2015, at approximately 5:00 p.m., Foreign Official-1 called ALZABARAH 
(25 seconds). 

76. Twitter User-9 is a well-known and influential critic of the government and Royal Family 
of Saudi Arabia with asylum in Canada. On June 19, 2015, and July 5, 2015, ALZABARAH accessed 
Twitter User-9’s account and was able to view the user’s account information. 

77. Based on Customs and Border Protection records, ALZABARAH flew from the United 
States to Saudi Arabia on July 11, 2015, and returned on August 14, 2015. ALZABARAH reported this 
absence to Twitter, and Twitter approved ALZABARAH’s personal leave from July 13 to August 11, 
2015. 

78. During ALZABARAH’s personal leave and concurrent with his travel to Saudi Arabia, 
he continued to access the private user data of numerous Twitter users, including Twitter User-1 and 
Twitter User-5. On July 18, 2015, one day after Twitter granted emergency disclosure requests made by 
Saudi Arabian law enforcement for Twitter User-10, Twitter User-11, and Twitter User-12, 
ALZABARAH accessed user information for those three accounts. 

79. Additionally, on July 18, 2015, while on personal leave in Saudi Arabia, ALZABARAH 

created and modified another Apple Note, which contains further notes of ALZABARAH contemplating 
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rewards and credit in exchange for the information that he had accessed for and provided to Foreign 
Official-1. Specifically, ALZABARAH’s Apple Note, which the FBI found in the search of 
ALZABARAFPs Apple ID account, stated the following bullet points in Arabic: 

• My situation there, where am I, and how is this going to affect me? 

e Huge mistake today, I feel that we were not included. I need to know who they are 
and why they are in charge of us. If something happens to him.. .1 don’t know 
anyone. I want to communicate directly. I feel that they are showing off. What is this? 

• We served them and they didn’t give us any credit at all. They took credit for the 
subject. As happened 11 years ago. Those sitting we give it to them [sic] this is scary, 
save us all from great things [Ac], Only you and I know this is grave injustice towards 
me and him. The issue is not purely financial, the issue is moral, honorary [UI], and 
credit. 

• I would like to improve in the lacking areas via the [charitable organization run by 
Foreign Official-1]. I would like to become a member in it by any means or take 
training classes in leadership and business administration. 

• Father’s matter is trivial and I was expecting help at least for what we did for 
them.. .Now they know the issue, a phone call to the man in charge and the problem 
is solved. 

• I want a permanent position... something that secures my future and my family’s, 
strengthens my relationship with them, and [makes me] feel reassured. 

• I need a phone, laptop, credit card, and 4G. How to connect as fast as possible [to the 
Internet] should I need to? To whom can I speak? 

• A weekly meeting or bi-weekly to check-in and such. 

[...] 

• The subject of taxes and how I had problems with it. 

80. Based on a review of the Security Set Identifiers (a sequence of characters that uniquely 
names a wireless local area network) identified in a court-approved search of ALZABARAH’s Twitter- 
issued computer, ALZABARAH used his Twitter laptop to connect to networks of ALMUTAIRI’s 
company in Saudi Arabia on July 29 and 30, 2015, during this period of personal leave. 

81. After returning to the United States, Foreign Official-1 continued to communicate with 
ALZABARAH, and ALZABARAH continued to access Twitter User-l’s private account data. For 
example, on August 20, 2015, Foreign Official-1 called ALZABARAH at approximately 12:06 p.m. 
Pacific (3 seconds), and ALZABARAH returned Foreign Official-l’s call at approximately 12:12 p.m. 


AFFIDAVIT OF FBI SA LETITIA WU 


21 




1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


Case 3:19-mj-71824-MAG Document 1 Filed 11/05/19 Page 23 of 27 


(56 seconds). Later that day, ALZABARAH accessed without authorization through Twitter’s computer 
systems the Twitter user data of Twitter User-1 from approximately 8:46 p.m. until 8:52 p.m. Pacific. 
ALZABARAH accessed eleven other Twitter users’ accounts on the same day, including the accounts of 
a possible critic of Saudi Arabia, the King of Saudi Arabia, and ABOUAMMO. 

82. Similarly, in September 2015, Foreign Official-1 called ALZABARAH on September 8, 
2015, at approximately 8:01 p.m. Pacific (5 minutes). Later that same month, ALZABARAH accessed 
without authorization through Twitter’s computer systems the Twitter user data of Twitter User-1 on 
September 27 and 28, 2015, which was the day before and the day that Twitter User-l’s Twitter account 
was reported “hacked,” which Twitter confirmed when Twitter User-1 filed a formal complaint. The 
“hacking” was claimed in online postings, and Twitter responded to User-1 ’s complaint stating that the 
account appeared to have been compromised. 

83. The FBI’s search of ALZABARAH’s Apple ID account shows that, on November 5, 
2015, between approximately 12:11 a.m. and 12:18 am. Pacific, ALZABARAH created another Apple 
Note that stated in Arabic in relevant part, “Today, I became officially a member of the technical team at 
Twitter. This is the fifth tier out of six for engineers in companies in the Silicon Valley... My happiness 
is unimaginable and wanted to share with you the good news... [Foreign Official-1] thank you for 
supporting me and for everything.. .As much as I am happy for the position, I am happier with and very 
proud of my work with you. As per your previous advice, I will not announce the news via my Twitter 
account unless you give me your permission. May God keep you safe!” 

G. Twitter’s Confrontation of ALZABARAH. and ALZABARAH’s Flight to Saudi Arabia 

84. Immediately after Twitter confronted ALZABARAH about his access of user data, 
ALZABARAH contacted ALMUTAIRI and another individual, identified here as Associate-1, to assist 
him in fleeing the United States by the next day. 

85. On or about December 2, 2015, Twitter confronted ALZABARAH regarding his 
unauthorized access of private data of Twitter users. ALZABARAH admitted to accessing user account 
information without authorization, but stated that he did so simply out of curiosity. ALZABARAH 
expressed his concern about both his employment and the status of his work visa, which Twitter had 
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sponsored. Twitter placed ALZABARAH on administrative leave, seized his Twitter-owned laptop 
computer, and escorted him from the building. 

86. At approximately 4:29 p.m., ALZABARAH left the Twitter building. As he drove to his 
apartment residence in San Bruno, California, ALZABARAH called ALMUTAIRI at approximately 
4:30 p.m. Phone records indicate this call was unanswered. Shortly after arriving at his residence, 
ALZABARAH also called (3 seconds) Associate-1 at approximately 5:17 p.m. While at his apartment 
complex that day, ALZABARAH visited the leasing office and told an assistant manager there that he 
was unsure of his visa status because he had been laid-off from Twitter. ALZABARAH stated he was 
going to try to find another job, but he may get deported. 

87. Next, based on the FBI’s contemporaneous observations of ALZABARAH and the FBI’s 
investigation afterwards, including obtaining phone records, the following occurred: 


Approximate 
Time (Pacific) 

Events of December 2, 2015 

7:18 p.m. 

ALZABARAH met outside his residence Associate-1, who was driving 
a white sport-utility vehicle. ALZABARAH entered Associate-l’s 
vehicle, and Associate-1 proceeded to drive around the area. 

7:20 p.m. 

While Associate-1 drove with ALZABARAH around ALZABARAH’s 
residence, Associate-1’s cellular telephone called (8 seconds) Foreign 
Official-1 ’s Saudi Arabian cellular telephone. 

7:22 p.m. 

Associate-1 ’s cellular telephone called (unanswered) Foreign Official- 
1 ’s Saudi Arabian cellular telephone. 

7:31 p.m. 

Associate-l’s cellular telephone called (unanswered) Foreign Official- 
1 ’s Saudi Arabian cellular telephone. 

7:48 p.m. 

Associate-1 returned ALZABARAH to his residence, and Associate-1 
departed the area in the vehicle. 

7:58 p.m. 

Foreign Official-1’s Saudi Arabian cellular telephone called the Saudi 
Arabian Consul General in Los Angeles (unanswered), and the Consul 
General returned the call at 8:03 p.m. (unanswered). 

8:03 p.m. 

Foreign Official-1 ’s Saudi Arabian cellular telephone called (8 seconds) 
Associate-1 ’s cellular telephone. 

8:05 p.m. 

Foreign Official-l’s Saudi Arabian cellular telephone called (3 minutes 

48 seconds) the Saudi Arabian Consul General in Los Angeles. 

8:09 p.m. 

Foreign Official-1’s Saudi Arabian cellular telephone called (5 seconds) 
Associate-1 ’s cellular telephone. 

8:30 p.m. 

ALZABARAH called (unanswered) the Saudi Arabian Consul General 
in Los Angeles. 

8:38 p.m. 

Associate-1 called (3 minutes, 48 seconds) the Saudi Arabian Consul 
General in Los Angeles. 


AFFIDAVIT OF FBI SA LETITIA WU 


23 























1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 


Case 3:19-mj-71824-MAG Document 1 Filed 11/05/19 Page 25 of 27 


9:26 p.m. 

ALZABARAH called (unanswered) the Saudi Arabian Consul General 
in Los Angeles from his Saudi cellular telephone. 

12:21 a.m. 
(Dec. 3,2015) 

The Saudi Arabian Consul General in Los Angeles called (3 minutes, 1 
second) ALZABARAH on his Saudi cellular telephone. 


88. The day after, on or about December 3, 2015, at approximately 7:00 a.m. Pacific, 
ALZABARAH, his wife, and his daughter boarded a flight at the San Francisco International Airport 
and flew (connecting through the Los Angeles International Airport) to Saudi Arabia. During the 
connection at the Los Angeles International Airport (ALZABARAH arrived in Los Angeles at 
approximately 8:32 a.m. and departed at approximately 3:00 p.m.), ALZABARAH and Associate-1 
exchanged three telephone contacts - one text message at approximately 8:31 a.m., one call (1 minute, 8 
seconds) at approximately 9:00 a.m., and one call (15 seconds) at approximately 12:16 p.m. Also during 
ALZABARAH’s layover in Los Angeles, ALZABARAH’s Saudi cellular telephone and the Saudi 
Arabian Consul General in Los Angeles exchanged three telephonic contacts - one call from 
ALZABARAH at approximately 9:56 a.m. (8 seconds), one call to ALZABARAH at approximately 
10:40 a.m. (2 minutes) and one call to ALZABARAH at approximately 11:39 a.m. (1 minute 30 
seconds). 

89. Between the time that ALZABARAH left the Twitter building on December 2, 2015, and 
his departure from San Francisco at approximately 7:00 am on December 3, 2015, ALZABARAH’s 
telephone records for his U.S. cellular phone indicate contact with only ALMUTAIRI, Associate-1, the 
Saudi Arabian Consul General in Los Angeles, ALZABARAH’s wife, his Twitter supervisor, one other 
Twitter employee, Wells Fargo Bank, U.S. Bank, and an Uber driver. 

90. On December 3, 2015 at approximately 11:38 p.m. Pacific, Twitter received an email 
from ALZABARAH stating that he was resigning from his employment at the company. Based on 
flight records, this email was transmitted while ALZABARAH was in the air. 

H. ALZABARAH’s Continued Work for Officials of The Kingdom of Saudi Arabia 

91. Within one month of arriving in Saudi Arabia, emails show that ALZABARAH began 

using an email address at a charitable foundation where Foreign Official-1 is the Secretary General. In 

particular, emails sent to and from ALZABARAH’s charitable foundation account show him working 

with ALMUTAIRI and several others, on a team to monitor and manipulate social media under Foreign 
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Official-1 ’s leadership and for the benefit of the Kingdom of Saudi Arabia. In March 2016, 
ALZABARAH emailed the “team,” which included ALMUTAIRI and Foreign Official-1, and stated 
that he had established a private website and virtual private network for them to use. ALZABARAH 
was working in that capacity continuously through at least June 2016. 

92. ALZABARAH has submitted several visa applications to return to the United States in 
which he has disclosed, among other things, employment by the Royal Family and Organization No. 1 
and listing Foreign Official-1 as his point of contact. 

93. As of May 9,2019, ALZABARAH has a valid B1 /B2 visa but has not yet returned to the 
United States. 

V. CONCLUSION 

94. Based on the foregoing, there is probable cause to believe that Ahmad ABOUAMMO, 
Ali ALZABARAH and Ahmed ALMUTAIRI acted in the United States as agents of the Kingdom of 
Saudi Arabia without prior notification to the Attorney General, as required by law, in violation of 18 
U.S.C. § 951. There is further probable cause that Ahmad ABOUAMMO knowingly falsified and 
transmitted to agents of the FBI a falsified invoice in order to obstruct a pending federal criminal 
investigation, in violation of 18 U.S.C. § 1519. 

95. Accordingly, I request the Court to issue the attached Criminal Complaint and Arrest 
Warrants. 

// 

// 

// 

// 


// - 
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VI. SEALING REQUEST 

96. Since this investigation is ongoing, disclosure of the complaint and this affidavit may 
jeopardize the progress of the investigation, result in the destruction of evidence, intimidation or 
collusion of witnesses, or the flight of a defendant. Accordingly, I request that the Court issue an order 
that the complaint, this affidavit in support, and any attachments thereto, along with the order itself, be 
filed under seal until further order of the Court. 

I declare under penalty of perjury that the above is true and correct to the best of nry knowledge 


and belief. 



Letitia L. Wu ^ 

Special Agent 

Federal Bureau of Investigation 


Sworn to and subscribed before me 
this kj day of November, 2019. 
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